Re: [PATCH mptcp-next 1/2] mptcp: pm: fix use-after-free in mptcp_userspace_pm_delete_local_addr

[Geliang Tang <geliang@kernel.org>]

Hi Tao,

Thanks for this set. It looks like the cover letter of this set is
missing. You can use "--cover-letter" to create it:

	git format-patch -2 --cover-letter

sashiko adds some comments here, please address them in v2:

https://sashiko.dev/#/patchset/20260509075629.217791-2-cuitao@kylinos.cn

On Sat, 2026-05-09 at 15:56 +0800, Tao Cui wrote:
> mptcp_userspace_pm_delete_local_addr() calls list_del_rcu() followed
> immediately by sock_kfree_s(), which frees the entry synchronously
> without waiting for an RCU grace period.  A concurrent RCU read-side
> lookup (e.g. via mptcp_userspace_pm_get_local_id) could still be
> accessing the freed entry.
> 
> Fix it by replacing sock_kfree_s() with kfree_rcu_mightsleep() and
> adjusting sk_omem_alloc manually, matching the pattern already used
> in mptcp_pm_nl_remove_doit() in the same file.
> 
> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
> ---
>  net/mptcp/pm_userspace.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c
> index 8cbc1920afb4..586e19e9b913 100644
> --- a/net/mptcp/pm_userspace.c
> +++ b/net/mptcp/pm_userspace.c
> @@ -109,7 +109,11 @@ static int
> mptcp_userspace_pm_delete_local_addr(struct mptcp_sock *msk,
>  	 * be used multiple times (e.g. fullmesh mode).
>  	 */
>  	list_del_rcu(&entry->list);
> -	sock_kfree_s(sk, entry, sizeof(*entry));
> +	kfree_rcu_mightsleep(entry);

mptcp_userspace_pm_delete_local_addr is invoked under the pm lock, so
using kfree_rcu_mightsleep is not a good idea.

Also, this mptcp_userspace_pm_delete_local_addr helper is removed in
the set [1] under review, so it's better to keep this sock_kfree_s
unchanged.

[1]
https://patchwork.kernel.org/project/mptcp/patch/e2c1bd781cdd4a7a0233305c0cc5cd12e36ec31c.1776466833.git.tanggeliang@kylinos.cn/

> +	/* Adjust sk_omem_alloc like sock_kfree_s() does, to match
> +	 * with allocation of this memory by sock_kmemdup()
> +	 */
> +	atomic_sub(sizeof(*entry), &sk->sk_omem_alloc);
>  	msk->pm.local_addr_used--;
>  	return 0;
>  }